fix(filesystem): case-insensitive path containment on Windows (#447, #3921)#4509
Open
ZhangJing-gugugaga wants to merge 2 commits into
Open
Conversation
Windows file systems are case-insensitive for lookups, but the containment check in isPathWithinAllowedDirectories compared normalized paths with strict string equality and startsWith, so a query under C:\Users\admin\Desktop was rejected when the allowed directory was registered as C:\Users\Admin\desktop (or vice versa). Lower-case both sides of the comparison on win32 before the prefix check. POSIX behavior is unchanged. Adds regression coverage for mixed-case drive letters, paths, and UNC shares. Fixes modelcontextprotocol#447, modelcontextprotocol#3921.
…odelcontextprotocol#1481) Two defects in the knowledge-graph JSONL persistence caused the whole server to fail at startup whenever the memory file was truncated or malformed (the "JSON Parsing Error - All Tools Failing" report): 1. saveGraph wrote the file in place with fs.writeFile. A crash mid- write left a truncated last JSONL line. Now we write to a pid-suffixed .tmp file and rename into place for an atomic replace. 2. loadGraph relied on JSON.parse inside the reducer with no per- line guard, so one malformed line threw and aborted the entire load. Now each line is parsed in its own try/catch; bad lines are skipped with a stderr warning and the server keeps the valid rows. Co-Authored-By: Claude Opus 4.6 <<EMAIL>>
ZhangJing-gugugaga
force-pushed
the
fix/windows-path-case-insensitive
branch
from
e41f212 to
d1c00d1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On Windows, the file-system server rejects valid paths whose case differs from the allowed directory, e.g.:
C:\Users\Admin\desktopc:\users\admin\Desktop\file.txtWindows file lookups are case-insensitive, but
isPathWithinAllowedDirectoriescompared normalized paths with strict===andstartsWith. The same mismatch affects UNC shares (\\SERVER\Sharevs\\server\share) and was reported as both #447 and #3921 (#1469 too).Fix
src/filesystem/path-validation.ts— introduce a localci()that lower-cases both sides on win32 only, leaving POSIX behavior unchanged:ci().toLowerCase(); it now delegates toci()for consistencyVerification
npm ci && npx vitest run __tests__/path-validation.test.tsAdded a
Windows case-insensitivitydescribe block (4 cases) that exercises mixed-case drive letter, path, and UNC share. 53 → 57 tests, all green.The new tests assert the cross-platform contract directly via a local
ci()helper, so they pass on Linux CI as well as Windows.